We are designing a Python application and we need to "load" encryption secret key in "memory" at the application boot. It can be also an admin pin code. Anyway, just some data.

Our application will run under docker container.

What is the most secure process to do it ? Can we trust the OS from any memory dump ?

Can we use some containers feature to isolate that part of memory to our process ?

Is there any kind of "secure/encrypted" cache system ? Redis ?

I believe that we MAY not find any extreme secure process, thus us there any obfuscation recommendations ?

Our application is targeted to run on the Cloud

  • 1
    Is storing the secret in the application really a fixed requirement or just the approach you came up when solving a specific problem (i.e. the Y in a XY problem)? Shouldn't the approach follow the overall security requirements instead - which are unknown in this case? What values are protected by the secret? How often do you need the secret? What/Who do you want to protect the secret from - bugs or information leaks in the application itself, the cloud provider, some other container, some other VM on the same hardware? Jan 9, 2021 at 9:24
  • This really depends on the threat model. To hide data from the cloud provider you'd have to use something like SGX but that's both broken and infeasible with Python. If you just want to prevent other applications on your server from dumping your memory, the solution would be to run those other apps as different non-root users, and preferably by running them in containers. Linux doesn't protect you from yourself. A better solution might be to make it possible to revoke keys when they are compromised, and have sufficient intrusion detection to know about compromises.
    – amon
    Jan 9, 2021 at 10:19
  • Look into Intel TXT (Trusted eXecuTion).
    – forest
    Jan 10, 2021 at 2:10
  • Also if all you want to do is protect the key from hitting the disk, mlock() is what you want.
    – forest
    Jan 10, 2021 at 2:23
  • Thanks for your answers, indeed we finally implemented a rootless docker installation, we beleive that we can't protect from root but at least our secrets are protected from other user. And yes, we have a key rotation system.
    – hzrari
    Jun 9, 2021 at 23:20


You must log in to answer this question.

Browse other questions tagged .